Predicting and preventing an attacker&#39;s next actions in a breached network

ABSTRACT

A method for cyber security, including detecting, by a management server, a breach by an attacker of a resource within a network of resources, predicting, by the management server, an attacker target subnet, based on connections created during the breach, and isolating, by the management server, the target subnet in response to the predicting a target subnet.

CROSS REFERENCES TO RELATED APPLICATIONS

This application is a non-provisional of U.S. Provisional ApplicationNo. 62/172,251, entitled SYSTEM AND METHOD FOR CREATION, DEPLOYMENT ANDMANAGEMENT OF AUGMENTED ATTACKER MAP, and filed on Jun. 8, 2015 byinventors Shlomo Touboul, Hanan Levin, Stephane Roubach, Assaf Mischari,Itai Ben David, Itay Avraham, Adi Ozer, Chen Kazaz, Ofer Israeli, OlgaVingurt, Liad Gareh, Israel Grimberg, Cobby Cohen and Sharon Sultan, thecontents of which are hereby incorporated herein in their entirety.

This application is a non-provisional of U.S. Provisional ApplicationNo. 62/172,253, entitled SYSTEM AND METHOD FOR MULTI-LEVEL DECEPTIONMANAGEMENT AND DECEPTION SYSTEM FOR MALICIOUS ACTIONS IN A COMPUTERNETWORK, and filed on Jun. 8, 2015 by inventors Shlomo Touboul, HananLevin, Stephane Roubach, Assaf Mischari, Itai Ben David, Itay Avraham,Adi Ozer, Chen Kazaz, Ofer Israeli, Olga Vingurt, Liad Gareh, IsraelGrimberg, Cobby Cohen and Sharon Sultan, the contents of which arehereby incorporated herein in their entirety.

This application is a non-provisional of U.S. Provisional ApplicationNo. 62/172,255, entitled METHODS AND SYSTEMS TO DETECT, PREDICT AND/ORPREVENT AN ATTACKER'S NEXT ACTION IN A COMPROMISED NETWORK, and filed onJun. 8, 2015 by inventors Shlomo Touboul, Hanan Levin, Stephane Roubach,Assaf Mischari, Itai Ben David, Itay Avraham, Adi Ozer, Chen Kazaz, OferIsraeli, Olga Vingurt, Liad Gareh, Israel Grimberg, Cobby Cohen andSharon Sultan, the contents of which are hereby incorporated herein intheir entirety.

This application is a non-provisional of U.S. Provisional ApplicationNo. 62/172,259, entitled MANAGING DYNAMIC DECEPTIVE ENVIRONMENTS, andfiled on Jun. 8, 2015 by inventors Shlomo Touboul, Hanan Levin, StephaneRoubach, Assaf Mischari, Itai Ben David, Itay Avraham, Adi Ozer, ChenKazaz, Ofer Israeli, Olga Vingurt, Liad Gareh, Israel Grimberg, CobbyCohen and Sharon Sultan, the contents of which are hereby incorporatedherein in their entirety.

This application is a non-provisional of U.S. Provisional ApplicationNo. 62/172,261, entitled SYSTEMS AND METHODS FOR AUTOMATICALLYGENERATING NETWORK ENTITY GROUPS BASED ON ATTACK PARAMETERS AND/ORASSIGNMENT OF AUTOMATICALLY GENERATED SECURITY POLICIES, and filed onJun. 8, 2015 by inventors Shlomo Touboul, Hanan Levin, Stephane Roubach,Assaf Mischari, Itai Ben David, Itay Avraham, Adi Ozer, Chen Kazaz, OferIsraeli, Olga Vingurt, Liad Gareh, Israel Grimberg, Cobby Cohen andSharon Sultan, the contents of which are hereby incorporated herein intheir entirety.

FIELD OF THE INVENTION

The present invention relates to cyber security, and in particular tocomputer network surveillance.

BACKGROUND OF THE INVENTION

Reference is made to FIG. 1, which is a simplified diagram of a priorart enterprise network 100 connected to an external internet 10. Network100 is shown generally with resources including computers 110, servers120, switches and routers 130, and mobile devices 140 such as smartphones and tablets, for ease of presentation, although it will beappreciated by those skilled in the art that enterprise networks todayare generally much more varied and complex and include other devicessuch as printers, phones and any Internet of Things objects. The variousconnections shown in FIG. 1 may be direct or indirect, wired or wirelesscommunications, or a combination of wired and wireless connections.Computers 110 and servers 120 may be physical elements or logicalelements, or a mix of physical and logical elements. Computers 110 andservers 120 may be physical or virtual machines. Computers 110 andservers 120 may be local, remote or cloud-based elements, or a mix oflocal, remote and cloud-based elements. Computers 110 may be clientworkstation computers. Servers 120 may be file transfer protocol (FTP)servers, email servers, structured query language (SQL) servers, secureshell (SSH) servers, and other database and application servers. Acorporate information technology (IT) department manages and controlsnetwork 100 in order to serve the corporate requirements and meet thecorporate needs.

Access to computers 110 and servers 120 in network 100 may optionally begoverned by an access governor 150, such as a directory service, thatauthorizes users to access computers 110 and servers 120 based on“credentials” and other methods of authentication. Access governor 150may be a name directory, such as ACTIVE DIRECTORY® developed byMicrosoft Corporation of Redmond, Wash., for WINDOWS® environments.Background information about ACTIVE DIRECTORY® is available atWikipedia. Other access governors for WINDOWS and non-WINDOWSenvironments include inter alia Lightweight Directory Access Protocol(LDAP), Remote Authentication Dial-In User Service (RADIUS), and AppleFiling Protocol (AFP), formerly APPLETALK®, developed by Apple Inc. ofCupertino, Calif. Background information about LDAP, RADIUS and AFP isavailable at Wikipedia.

Access governor 150 may be one or more local machine access controllers.For networks that do not include an access governor, authentication maybe performed by other servers 120. Alternatively, in lieu of accessgovernor 150, resources of network 100 determine their local accessrights.

Credentials for accessing computers 110 and servers 120 include interalia server account credentials such as <address> <username> <password>for an FTP server, a database server, or an SSH server. Credentials foraccessing computers 110 and servers 120 also include user logincredentials <username> <password>, or <username> <ticket>, where“ticket” is an authentication ticket, such as a ticket for the Kerberosauthentication protocol or NTLM hash used by Microsoft Corp., or logincredentials via certificates or via another method of authentication.Background information about the Kerberos protocol and LM hashes isavailable at Wikipedia.

Access governor 150 may maintain a directory of computers 110, servers120 and their users. Access governor 150 authorizes users and computers,assigns and enforces security policies, and installs and updatessoftware.

Computers 110 may run a local or remote security service, which is anoperating system process that verifies users logging in to computers, toother single sign-on systems and to other credential storage systems.

Network 100 may include a security information and event management(SIEM) server 160, which provides real-time analysis of security alertsgenerated by network hardware and applications. Background informationabout SIEM is available at Wikipedia.

Network 100 may include a domain name system (DNS) server 170, or suchother name service system, for translating domain names to IP addresses.Background information about DNS is available at Wikipedia.

Network 100 may include a firewall 180 located within a gateway betweenenterprise network 100 and external internet 10. Firewall 180 controlsincoming and outgoing traffic for network 100. Background informationabout firewalls is available at Wikipedia.

One of the most prominent threats that organizations face is a targetedattack; i.e., an individual or group of individuals that attacks theorganization for a specific purpose, such as stealing data, using dataand systems, modifying data and systems, and sabotaging data andsystems. Targeted attacks are carried out in multiple stages, typicallyincluding inter alia reconnaissance, penetration, lateral movement andpayload. Lateral movement involves orientation, movement andpropagation, and includes establishing a foothold within theorganization and expanding that foothold to additional systems withinthe organization.

In order to carry out the lateral movement stage, an attacker, whether ahuman being who is operating tools within the organization's network, ora tool with “learning” capabilities, learns information about theenvironment it is operating in, such as network topology, networkdevices and organization structure, learns “where can I go from mycurrent location” and “how can I go from my current location to anotherlocation (privilege required)”, learns implemented security solutions,learns applications that he can leverage, and then operates inaccordance with that data.

An advanced attacker may use different attack techniques to enter acorporate network and to move laterally within the network in order toobtain his resource goals. The advanced attacker may begin with aworkstation, server or any other network entity to start his lateralmovement. He uses different methods to enter the network, includinginter alia social engineering, existing exploit and/or vulnerability,and a Trojan horse or any other malware allowing him to control a firstnode or nodes.

Once an attacker has taken control of a first node in a corporatenetwork, he uses different advanced attack techniques for orientationand propagation and discovery of additional ways to reach other networknodes in the corporate network. Attacker movement from node to node isperformed via an “attack vector”, which is an object discovered by theattacker, including inter alia an object in memory or storage of a firstcomputer that may be used to access or discover a second computer.

Exemplary attack vectors include inter alia credentials of users withescalated privileges, existing share names on different servers andworkstations, and details including address and credentials of an FTPserver, an email server, a database server or an SSH server. Attackvectors are often available to an attacker because a user did not logoff of his workstation, did not log out of an application, or did notclear his cache. E.g., if a user contacted a help desk and gave a helpdesk administrator remote access to his workstation, and if the helpdesk administrator did not properly log off from the remote accesssession to the users workstation, then the help desk access credentialsmay still be stored in the user's local cache and available to theattacker. Similarly, if the user accessed a server, e.g., an FTP server,then the FTP account login parameters may be stored in the user's localcache or profile and available to the attacker.

Attack vectors enable inter alia a move from workstation A 4 server Bbased on a shared server host name and its credentials, connection to adifferent workstation using local admin credentials that reside on acurrent workstation, and connection to an FTP server using specificaccess credentials.

Whereas IT “sees” the logical and physical network topology, an attackerthat lands on a first network node “sees” attack vectors that departfrom that node and move laterally to other nodes. The attacker can moveto such nodes and then follow “attack paths” by successively discoveringattack vectors from node to node.

When the attacker implements such a discovery process on all nodes inthe network, he will be able to “see” all attack vectors of thecorporate network and generate a “complete attack map”. Before theattacker discovers all attack vectors on network nodes and completes thediscovery process, he generates a “current attack map” that is currentlyavailable to him.

An objective of the attacker is to discover an attack path that leadshim to a target network node. The target may be a bank authorized serverthat is used by the corporation for ordering bank account transfers ofmoney, it may be an FTP server that updates the image of all corporatepoints of sale, it may be a server or workstation that storesconfidential information such as source code and secret formulas of thecorporation, or it may be any other network nodes that are of value tothe attacker and are his “attack goal nodes”.

When the attacker lands on the first node, but does not know how toreach the attack goal node, he generates a current attack map that leadsto the attack goal node.

One method to defend against such attacks, termed “honeypots”, is toplant and to monitor bait resources, with the objective that theattacker discover their existence and then consume the bait resources,and to notify an administrator of the malicious activity. Backgroundinformation about honeypots is available at Wikipedia.

Conventional honeypot systems operate by monitoring access to asupervised element in a computer network, the supervised element being afake server or a fake service. Access monitoring generates many falsealerts, caused by non-malicious access from automatic monitoring systemsand by user mistakes. Conventional systems try to mitigate this problemby adding a level of interactivity to the honeypot, and by performingbehavioral analysis of suspected malware if it has infected the honeypotitself.

After detection that a resource has been breached by an attack,conventional security systems react by isolating the breached resource.The breached resource may be isolated by manually unplugging it, or byrunning a system restore. Such reaction to detection of a breach hasmany drawbacks. In particular, an attacker may already have control overother resources of enterprise network 100. The attacker may haveobtained data, such as credentials, connection, and IP addresses, andcan continue spreading through enterprise network 100 without requiringuse of the specific resource that was isolated. Dependence upon manualisolation, which may be faulty, is very risky.

SUMMARY

Embodiments of the present invention overcome the drawbacks ofconventional security systems that react to an attack by isolating abreached resource. Using the present invention, an attacker's movementinside an enterprise network is predicted, and prevented inter alia bychanging compromised credentials and compromised IP addresses, and byadding firewall rules for compromised connections.

There is thus provided in accordance with an embodiment of the presentinvention a method for cyber security, including detecting, by a decoymanagement server, a breach by an attacker of a specific resource withina network of resources in which users access the resources based oncredentials, wherein each resource has a domain name server (DNS) recordstored on a DNS server, wherein some of the resources are servers thatare accessed via IP addresses, and wherein access to the network viaconnections that extend outside the network is governed by a firewall,changing, by the decoy management server, the DNS record for thebreached resource on the DNS server, in response to the detecting,predicting, by the decoy management server, which credentials arecompromised, based on credentials stored on the breached resource,changing, by the decoy management server, those credentials that werepredicted to be compromised, in response to the predicting whichcredentials, predicting, by the decoy management server, which serversin the network are compromised, based on real and decoy connectionscreated during the breach, changing, by the decoy management server, IPaddresses of servers in response to the predicting which servers,predicting, by the decoy management server, a target subnet, based onreal and decoy connections created during the breach, isolating, by thedecoy management server, the target subject in response to thepredicting a target subnet, predicting, by the decoy management server,data leakage paths from inside the network to outside the network, basedon an open connection to outside the network during the breach, andcreating, by the decoy management server, firewall rules to blockoutbound connections in response to the predicting data leakage paths.

There is additionally provided in accordance with an embodiment of thepresent invention a method for cyber security, including detecting, by adecoy management server, a breach by an attacker of a specific resourcewithin a network of resources, wherein access to the resources vianetwork connections is governed by a firewall, predicting, by the decoymanagement server, which resources of the network were exposed to theattacker, based on address pointers stored on the breached resource, andgenerating firewall rules to block access to the predicted exposedresources from the breached resource, in response to the predictingwhich resources.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be more fully understood and appreciated fromthe following detailed description, taken in conjunction with thedrawings in which:

FIG. 1 is a simplified diagram of a prior art enterprise networkconnected to an external internet;

FIG. 2 is a simplified diagram of an enterprise network with networksurveillance, in accordance with an embodiment of the present invention;and

FIG. 3 is a simplified flowchart of a method for prediction andprevention of an attacker's next action in a compromised network, inaccordance with an embodiment of the present invention.

For reference to the figures, the following index of elements and theirnumerals is provided. Similarly numbered elements represent elements ofthe same type, but they need not be identical elements.

Table of elements in the FIGURES Element Description 10 Internet 100enterprise network 110 network computers 120 network servers 130 networkswitches and routers 140 mobile devices 150 access governor (optional)252 forensic alert module 160 SIEM server 170 DNS server 180 firewall200 enterprise network with network surveillance 210 deceptionmanagement server 211 policy manager 212 deployment module 213 forensicapplication 220 database of credential types 230 policy database 240decoy servers 242 forensic alert module 260 update serverElements numbered in the 1000's are operations of flow charts.

DETAILED DESCRIPTION

In accordance with embodiments of the present invention, systems andmethods are provided for responding to breach by an attacker of aresource within an enterprise network, by predicting and preventing theattacker's next actions.

Reference is made to FIG. 2, which is a simplified diagram of anenterprise network 200 with network surveillance, in accordance with anembodiment of the present invention. Network 200 includes a decoymanagement server 210, a database 220 of decoy attack vectors, a policydatabase 230 and decoy servers 240. In addition, network computers 110and servers 120 are grouped into groups G1, G2, G3 and G4.

Database 220 stores attack vectors that fake movement and access tocomputers 110, servers 120 and other resources in network 200. Attackvectors include inter alia:

user of the form <username>

user credentials of the form <username> <password>

user credentials of the form <username> <hash of password>

user credentials of the form <username> <ticket>

FTP server of the form <FTP address>

FTP server credentials of the form <FTP address> <username> <password>

SSH server of the form <SSH address>

SSH server credentials of the form <SSH address> <username> <password>

share address of the form <SMB address>

Each decoy attack vector in database 220 may point to (i) a realresource that exists within network 200, e.g., an FTP server, (ii) adecoy resource that exists within network 200, e.g., a trap server, or(iii) a resource that does not exist. In the latter case, when anattacker attempts to access a resource that does not exist, accessgovernor 150 recognizes a pointer to a resource that is non-existent.Access governor 150 responds by notifying decoy management server 210,or by re-directing the pointer to a resource that does exist in order tosurvey the attacker's moves, or both.

The attack vectors stored in database 220 are categorized by families,such as inter alia

F1—user credentials

F2—files

F3—connections

F4—FTP logins

F5—SSH logins

F6—share names

F7—databases

F8—network devices

F9—URLs

F10—Remote Desktop Protocol (RDP)

F11—recent commands

F12—scanners

F13—cookies

F14—cache

F15—Virtual Private Network (VPN)

F16—key logger

Credentials for a computer B that reside on a computer A, or even anaddress pointer to computer B that resides on computer A, provide anattack vector for an attacker from computer A 4 computer B.

Database 220 communicates with an update server 260, which updatesdatabase 220 as attack vectors for accessing, manipulating and hoppingto computers evolve over time. Update server 260 may be a separateserver, or a part of decoy management server 210.

Policy database 230 stores policies for planting decoy attack vectors incomputers of network 200. Each policy specifies decoy attack vectorsthat are planted on the computers, in accordance with attack vectorsstored in database 220. For user credentials, the decoy attack vectorsplanted on a computer lead to another resource in the network. Forattack vectors to access an FTP or other server, the decoy attackvectors planted on a computer lead to a decoy server 240.

It will be appreciated by those skilled in the art the databases 220 and230 may be combined into a single database, or distributed over multipledatabases.

Decoy management server 210 includes a policy manager 211, a deploymentmodule 212, and a forensic application 213. Policy manager 211 defines adecoy and response policy. The decoy and response policy definesdifferent decoy types, different decoy combinations, responseprocedures, notification services, and assignments of policies tospecific network nodes, network users, groups of nodes or users or both.Once policies are defined, they are stored in policy database 230 withthe defined assignments.

Deception management server 210 obtains the policies and theirassignments from policy database 230, and delivers them to appropriatenodes and groups. It than launches deployment module 212 to plant decoyson end points, servers, applications, routers, switches, relays andother entities in the network. Deployment module 212 plants each decoy,based on its type, in memory (RAM), disk, or in any other data orinformation storage area, as appropriate. Deployment module 212 plantsthe decoy attack vectors in such a way that the chances of a valid useraccessing the decoy attack vectors are Deployment module 212 may or maynot stay resident.

Forensic application 213 is a real-time application that is transmittedto a destination computer in the network, when a decoy attack vector isaccessed by a computer 110. When forensic application 213 is launched onthe destination computer, it identifies a process running within thatcomputer 110 that accessed that decoy attack vector, or identifies a DLLin memory injected into a process, that accessed that decoy attackvector, or identifies static data that accessed that decoy attackvector. Forensic application 230 logs the activities performed by thethus-identified process in a forensic report, and transmits the forensicreport to decoy management server 210.

Once an attacker is detected, a “response procedure” is launched. Theresponse procedure includes inter alia various notifications to variousaddresses, and actions on a decoy server such as launching aninvestigation process, and isolating, shutting down and re-imaging oneor more network nodes. The response procedure collects informationavailable on one or more nodes that may help in identifying theattacker's attack acts, intention and progress.

Each decoy server 240 includes a forensic alert module 242, which alertsmanagement system 210 that an attacker is accessing the decoy server viaa computer 110 of the network, and causes decoy management server 210 tosend forensic application 213 to the computer that is accessing thedecoy server. In an alternative embodiment of the present invention,decoy server 240 may store forensic application 213, in which case decoyserver 240 may transmit forensic application 213 directly to thecomputer that is accessing the decoy server. In another alternativeembodiment of the present invention, decoy management server 210 ordecoy server 240 may transmit forensic application 213 to a destinationcomputer other than the computer that is accessing the decoy server.Access governor 150 also activates a forensic alert module 252, whichalerts decoy management server 210 that an attacker is attempting to usea decoy credential.

Notification servers (not shown) are notified when an attacker uses adecoy. The notification servers may discover this by themselves, or byusing information stored on access governor 150 and SIEM 160. Thenotification servers forward notifications, or results of processingmultiple notifications, to create notification time lines or such otheranalytics.

Reference is made to FIG. 3, which is a simplified flowchart of a methodfor prediction and prevention of an attacker's next action in acompromised network, in accordance with an embodiment of the presentinvention. At operation 1005, decoy management server 210 detects breachof a resource of enterprise network 200, based on an attacker's use ofone or more decoy attack vectors. At operation 1010, in response todetection of the breach at operation 1005, decoy management server 210changes one or more DNS records for the breached resource on DNS server170.

At operation 1015, decoy management server 210 collects data from theforensic report received by forensic application 213, the collected dataincluding both decoy and real data for the breached resource. Atoperation 1020, decoy management server 210 discriminates between thereal and the decoy data collected at operation 1015.

At operation 1025, decoy management server 210 predicts whichcredentials are compromised, based on credentials that are stored on thebreached resource. At operation 1030, in response to the prediction atoperation 1005, decoy management server 210 changes passwords ofcompromised users.

At operation 1035, decoy management server 210 predicts which servers innetwork 200 are compromised, based on real and decoy connections createdduring the breach. At operation 1040, in response to the prediction atoperation 1035, decoy management server 210 changes IP addresses forcompromised servers. Optionally, in addition, firewall rules may begenerated to block the compromised servers from being accessed from thebreached resources.

At operation 1045, decoy management server 210 predicts one or moretarget subnets, based on real and decoy connections created during thebreach. At operation 1050, in response to the prediction at operation1045, decoy management server 210 isolates the infected resource and theone or more target subnets.

At operation 1055, decoy management server 210 predicts data leakagepaths from inside network 200 to outside network 200, based on an openconnection to outside of the network during the breach. At operation1060, in response to the prediction at operation 1055, decoy managementserver 210 generates firewall rules to block malicious outboundconnections. In an alternative embodiment, decoy management server 210may generate firewall rules to re-direct outbound connections to adesignated resource within network 200.

Each of the individual response operations 1010, 1030, 1040, 1050 and1060 is itself optional, and may not be performed in some embodiments ofthe present invention. Moreover, response operations 1010, 1030, 1040,1050 and 1060 may be performed automatically by decoy management server210, or semi-automatically in conjunction with confirmation by anadministrator, or manually whereby the method recommends each responseoperation to an administrator, but the administrator must manuallyperform the operation.

In the foregoing specification, the invention has been described withreference to specific exemplary embodiments thereof. It will, however,be evident that various modifications and changes may be made to thespecific exemplary embodiments without departing from the broader spiritand scope of the invention. Accordingly, the specification and drawingsare to be regarded in an illustrative rather than a restrictive sense.

What is claimed is:
 1. A method for cyber security for a network of resources, wherein access to the resources via network connections that extend outside the network is governed by a firewall, the method comprising: detecting, by a management server, a breach by an attacker of a resource within a network of resources; predicting, by the management server, the attacker's target network subnet, based on network connections created by the attacker during the detected breach; isolating, by the management server, the predicted attacker's target network subnet in response to said predicting the attacker's target network subnet; predicting, by the management server, data leakage paths from inside the network to outside the network, based on an outbound network connection opened by the attacker and detected by the management server, during the breach; and creating, by the management server, firewall rules to re-direct the outbound network connection opened by the attacker to a resource within the network, in response to said predicting the data leakage paths, wherein the re-directed outbound network connection to a resource within the network appears to the attacker to be the attacker's intended outbound network connection to the attacker's intended destination outside the network.
 2. The method of claim 1 comprising creating, by the management server, firewall rules to block the attacker-created outbound network connection in response to said predicting the data leakage paths.
 3. A method for cyber security for a network of resources, wherein access to the resources via network connections that extend outside the network is governed by a firewall, the method comprising: detecting, by a management server, a breach by an attacker of a resource within a network of resources, wherein access to the resources via network connections is governed by a firewall; predicting, by the management server, which resources of the network were exposed to the attacker, based on address pointers stored on the breached resource; creating, by the management server, firewall rules to block access to the predicted attacker exposed resources from the breached resource, in response to said predicting which resources of the network were exposed to the attacker; predicting, by the management server, data leakage paths from inside the network to outside the network, based on an outbound network connection opened by the attacker and detected by the management server, during the breach; and creating, by the management server, firewall rules to re-direct the outbound network connection opened by the attacker to a resource within the network, in response to said predicting the data leakage paths, wherein the re-directed outbound network connection to a resource within the network appears to the attacker to be the attacker's intended outbound network connection to the attacker's intended destination outside the network.
 4. The method of claim 3 comprising creating, by the management server, firewall rules to block the attacker-created outbound network connection in response to said predicting the data leakage paths. 